CVE-2011-1163: Input Validation

The kernel automatically evaluates partition tables of storage devices. The code for evaluating OSF partitions (in fs/partitions/osf.c) contains a bug that leaks data from kernel heap memory to userspace for certain corrupted OSF partitions.

In more detail (from Kernel 2.6.37 fs/partition/osf.c):

(66) for (i = 0 ; i < le16tocpu(label->dnpartitions); i++, partition++) {

iterates from 0 to dnpartitions - 1, where

dnpartitions is read from the partition table without validation and partition is a pointer to an array of at most 8 dpartitions.

(70) putpartition(state, slot, (71) le32tocpu(partition->poffset), (72) le32tocpu(partition->psize));

adds a partition based on data referenced by partition. As partition may point beyond the partition table data structure, poffset and psize are read from kernel heap beyond the partition table.

In some cases, putpartition logs error messages to userspace including the poffset and psize values. Hence, some values from kernel heap are leaked to userspace.

So validate the value of dnpartitions.

Reference: http://www.spinics.net/lists/mm-commits/msg82737.html

Acknowledgements:

Red Hat would like to thank Timo Warns for reporting this issue.

— Red Hat

The osfpartition function in fs/partitions/osf.c in the Linux kernel before 2.6.38 does not properly handle an invalid number of partitions, which might allow local users to obtain potentially sensitive information from kernel heap memory via vectors related to partition-table parsing.

— Launchpad